Security Basics
Minimum security requirements before shipping a product to users.
Check
Verify all of: (1) HTTPS enforced everywhere with HSTS header, (2) auth tokens stored in httpOnly cookies (not localStorage), (3) all user inputs sanitized before rendering (XSS prevention), (4) CSRF tokens on state-changing forms, (5) sensitive data not logged or exposed in client-side JS, (6) rate limiting on auth endpoints, (7) dependency audit run (npm audit / Dependabot).
Why This Matters
Security failures are irreversible trust violations. The items in this checklist represent the most common attack vectors in web applications. None require specialized security expertise — they are standard implementation patterns that every shipping product needs.
Category
Security
Priority
critical
How to Verify
Run OWASP ZAP or Burp Suite Community Edition against staging. Check browser DevTools: no sensitive data in local storage, cookies have httpOnly and Secure flags. Run npm audit — zero critical vulnerabilities.